Threat database

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.

CVE-2026-109901 is a high severity SQL Injection vulnerability in Codepeople CP Multi View Event Calendar affecting versions from 0 up to 1.4.41. This flaw allows an attacker with low privileges and no user interaction to cause a partial denial of service and potentially impact confidentiality by injecting malicious SQL commands. No official patch or remediation information is provided in the source data.

CVE-2026-94590 is a medium severity vulnerability in CodePeople2 Sell Downloads that involves improper verification of the source of a communication channel. This flaw allows exploitation of trusted credentials, potentially leading to unauthorized access or actions. The vulnerability affects Sell Downloads versions from the initial release up to 1.2.3 inclusive. There is no information provided about available patches or vendor advisories.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.<name>)' parameter in all versions up to, and including, 5.5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to host a publicly accessible form in which an administrator has configured at least two fields with url.&lt;name&gt; predefined values that are used together in a concatenation equation — a plausible but not universal configuration.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to a reflected DOM-based cross-site scripting (XSS) attack via a parameter that matches the form's url.<name> predefined value. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. Exploitation requires the targeted form to have a Text Area field configured with a 'url.<name>' predefined value and predefinedClick disabled, which is a common plugin feature.

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (any URL parameter consumed by the form's calculated equation)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the target site to have a public form configured with a Select2-enabled dropdown whose choices are populated via a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); given that configuration, exploitation requires only a single crafted link.

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

CVE-2026-78283 is a high severity vulnerability in the Music Player for WooCommerce plugin by codepeople. It is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 1.8.9. The flaw allows improper neutralization of input during web page generation, potentially leading to cross-site scripting attacks. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-78281 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability in codepeople CP Media Player versions up to and including 1.3.0. This vulnerability allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.

Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.

Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.

The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function, which is reachable via the cpabc_calendar_load2=1 query parameter in wp-admin and only checks is_admin() && current_user_can('edit_posts'), a capability available to Contributor-level users and above. This makes it possible for authenticated attackers with Contributor-level access and above to supply an arbitrary calendar ID via the id parameter and extract customer booking information, including email addresses, names, phone numbers, booking times, and comments, from any calendar managed by the plugin.

Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.